You can change a password, not a driver's license — what Times Car members should do after the breach

Affected people are Times Car members and former members (including those who applied but did not complete registration), and Times Business Service members and former members. That includes people who used the service years ago and people who uploaded a license image but never finished signing up. The company says it will contact affected people individually. If you might be affected, you do not need to wait for that notice to take the steps below.

The leaked data combines name, address, date of birth, phone number and email address. With all of that, a scammer can write a very convincing message. If you get a message about "refund procedures", "re-submitting your license for verification" or "re-registering your card", do not open the link; open the official app or website yourself instead. The company also asks members not to enter passwords, verification codes or card details in response to messages that impersonate it (see What is phishing?).

This is available when your name may be misused because an identity document was lost, stolen or leaked. Once registered, lenders and card issuers see the note when they check your file and review applications more carefully. Japan has three credit bureaus — CIC, JICC and the Japanese Bankers Association's credit information center — with different member companies, so registering with all three gives the widest coverage. Applications are accepted online or by post (fees and methods differ; see the sources at the end).

A fraud alert does not block applications; it asks lenders to be more careful. So also keep a way to confirm nothing was actually opened in your name. Each bureau lets you request your own credit file. Check it once now and again a few months later for cards or loans you never applied for. If you receive an unfamiliar contract, a collection notice or mail from a business you never used, contact that business and your local police station.

Japan's Act on the Protection of Personal Information lets you request that a business stop using or delete your data when a reportable leak has occurred or when the business no longer needs the data (Article 35, paragraph 5). Former members, people who only started an application, and anyone who does not plan to use the service again can ask, through the contact form on the official site, for deletion of their data, including license images. Some records may have to be kept by law, but getting a written answer on what remains and when it will be deleted is worth it on its own.

The company says passwords were stored in a form that cannot be restored and that the leaked data cannot be used to misuse accounts, so it is not asking for a change. If you use the same password on other services, though, separate them now. A password manager is the realistic way to do the inventory.

For corporate members, department names were also leaked. Name, department and email address together make it easier to write emails that impersonate a business partner or a colleague. Circulate a rule now: requests such as "our bank account has changed" or "please review this urgently" are verified through another channel, such as a phone call (protecting your own domain: Email spoofing and SPF, DKIM, DMARC).

After verification, day-to-day operations usually need only when, with which document and by whom the check was done, plus the license expiry date. For each item, confirm whether keeping the image itself is required by law or audit, or whether it stays only because no one built a way to delete it.

Japan's privacy law asks businesses to make efforts to delete personal data without delay once it is no longer needed (Article 22, a duty of effort), and after a leak, individuals can demand deletion (Article 35(5)). Document images of people who left or abandoned sign-up are not used by the business but are still in scope when a breach happens. Keep them for the legally required period if there is one, otherwise set a short deadline, and make them delete automatically when it passes. Manual deletion does not last.

If the web system that takes sign-ups and bookings can read the document-image store with the same permissions, breaking the web side exposes the images too. Keep images in a separate store with separate keys, and let the web side see only a "verified" result. The underlying ideas are covered in The minimum security baseline for organizations and Authentication vs. authorization.